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Abstract 

The  underlying  philosophy  of  the  GPS  2R  TSA  architecture  is  to  utilize  two  frequency  sources,  one  fixed 
frequency  reference  source  and  one  system  frequency  source,  and  to  couple  the  system  frequency  source  to 
the  reference  frequency  source  via  a  sample  data  loop.  The  system  source  is  used  to  provide  the  basic  clock 
frequency  and  timing  for  the  space  vehicle  (SV)  and  it  uses  a  VCXO  with  high  short  term  stability.  The 
reference  source  is  an  atomic  frequency  standard  ( AFS )  with  high  long  term  stability.  The  architecture  can 
support  any  type  of  frequency  standard.  In  tlw  system  design  rubidium,  cesium,  and  H2  masers  outputting  a 
canonical  frequency  were  accommodated.  The  architecture  is  software  intensive.  All  VCXO  adjustments  are 
digital  and  are  calculated  by  a  processor.  They  are  applied  to  the  VCXO  via  a  DAC. 


DESCRIPTION  OF  TSA  ARCHITECTURE 


The  GPS  2R  TSA  architecture  is  illustrated  by  Figure  1.  An  AFS  is  used  as  a  reference  frequency 
source.  It  operates  with  a  fixed,  minimum  C  field  and  provides  an  output  frequency  that  can  easily 
be  multiplied  to  the  resonant  frequency  of  the  particular  AFS  being  utilized.  It  contains  no  frequency 
synthesizers  or  extra  feedback  loops  and  no  frequency  adjustments.  The  nominal  output  frequency  of 


FIGURE  1  TSA  ARCHITECTURE 
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the  AFS  is  not  critical;  in  this  implementation  it  is  13.4  MIIz.  A  stable  VCXO  is  used  as  an  system 
frequency  source.  Its  nominal  frequency  is  10.23  MHz  (GPS  frequency)  adjustable  in  1  micro  Hz  steps 
over  a  range  of  10  Hz  to  accommodate  aging  and  selective  availability  (SA).  The  AFS  and  VCXO 
outputs  are  divided  to  obtain  1.5  second  “epochs”.  These  epochs  are  compared  in  a  phase  meter  and 
the  measured  phase  difference  between  the  AFS  and  the  VCXO  epochs  is  compared  to  the  predicted 
phase  difference  generated  by  a  software  phase  difference  predictor.  The  result  of  the  comparison  is 
a  loop  error  signal  that  represents  the  difference  in  phase  between  the  VCXO  and  the  AFS.  The  loop 
error  signal  is  converted  by  the  processor  to  a  VCXO  control  voltage  (DFCMD)  which  is  applied  to 
the  VCXO  (after  compensation  for  VCXO  non  linearity)  to  remove  the  phase  difference.  The  loop 
filter  smooths  the  phase  meter  output  (a  running  average)  and  provides  a  software  controlled,  loop 
time  constant.  The  loop  time  constant  is  normally  quite  long  but  switches  to  a  short  time  constant 
when  fast  frequency  corrections  are  required.  DFCMD  is  generated  every  1.5  seconds.  The  frequency 
of  the  VCXO  can  also  be  dithered  by  adjusting  the  DFCMD  and  compensating  the  output  of  the 
phase  difference  predictor. 

The  phase  difference  predictor  uses  AFS  and  VCXO  performance  algorithms  stored  in  the  processor 
to  adjust  the  phase  difference  prediction  to  take  into  account  the  actual  frequency  of  the  AFS,  its  fre¬ 
quency  drift  (in  the  case  of  a  rubidium  AFS),  its  temperature  sensitivity,  relativistic  and  gravitational 
effects,  and  the  non-linear  response  of  the  VCXO  to  control  voltages.  Since  the  AFS  is  asynchronous 
to  GPS  time,  the  phase  difference  predictor  also  keeps  track  of  the  precession  between  the  epochs 
generated  from  the  AFS  frequency  and  the  epochs  generated  from  GPS  time.  Since  the  divider  in  the 
reference  epoch  generator  only  divides  by  whole  numbers,  keeping  track  of  precession  is  a  book  keeping 
process  until  it  reaches  a  value  close  to  the  value  of  the  AFS  period.  When  this  value  is  reached,  the 
divider  in  the  reference  epoch  generator  is  adjusted  by  a  whole  count.  The  non  linear  response  of  the 
VCXO  to  control  voltage  changes  and  DAC  non-linearity  are  taken  into  account  when  the  DFCMD 
is  generated.  The  VCXO  characterization  ensures  that  VCXO  tuning  is  at  the  center  of  the  tuning 
range  of  the  DAC  so  that  there  is  sufficient  range  to  take  care  of  VCXO  aging  and  SA.  The  Z  counter 
indicates  real  time  by  counting  the  reference  epochs. 


DESIGN  CONSTRAINTS  UPON  TSA  ARCHITECTURE 

Performance  specifications  impose  various  design  constraints  upon  the  architecture.  The  requirement 
that  the  TSA  be  capable  of  operating  for  6  months  without  ground  assistance  has  the  most  severe 
impact  on  the  design.  It  requires  that  the  performance  of  the  AFS  (and  to  some  extent  the  VCXO)  be 
predictable  to  close  tolerances  for  6  months.  In  order  to  meet  this  requirement  the  AFS  performance 
must  be  modeled  prior  to  launch  and  the  model  stored  in  processor  memory  for  use  during  orbital 
operation.  It  must  also  be  possible  to  update  these  characteristics  as  a  result  of  ground  measurements. 
The  impact  of  other  specifications  are,  for  the  most  part,  minimal.  Radiation  and  prompt  dose 
specifications  require  the  use  of  tantalum  shielding  and  CMOS  SOS  technology  for  selected  circuits  and 
require  that  the  AFS  output  use  tuned  circuits  to  “flywheel”  through  nuclear  upsets.  Specially  designed 
circuits  are  also  required  to  convert  from  the  analog  to  the  digital  domain.  The  most  significant 
constraints  are  listed  below. 

•  Ensure  TSA  operation  for  6  months  without  ground  assistance. 

•  Ensure  that  there  can  be  no  undetected  failure. 

•  Operate  through  single  event  (random)  upsets. 
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•  Make  TSA  radiation  and  nuclear  event  resistant. 

•  Provide  for  ground  control  override  of  all  autonomous  actions. 

•  Provide  dual  redundancy. 


IMPLEMENTATION  OF  TSA  ARCHITECTURE 


The  TSA  system  design  is  illustrated  by  the  hardware  diagram  of  Figure  2.  Dual  redundancy  is 
used  throughout  for  reliability  reasons  except  that  three  AFS  are  used;  two  rubidium  (RAFS)  and 
one  cesium  (CAFS).  It  is  intended  that  two  rubidium  standards  be  powered  up  at  all  times.  One 
standard  will  be  on-line  and  the  other  will  be  a  hot  standby.  Failure  of  the  on-line  standard  (reference 
frequency  source)  will  result  in  an  automatic  switchover  to  the  hot  standby.  Switchover  is  accomplished 
without  effecting  the  navigation  mission  of  the  SV  because  the  high  stability  VCXO  will  “free  run” 
during  switchover  and  the  hot  AFS  will  be  synchronized  to  the  VCXO  before  it  takes  over  as  the 
reference  frequency  source.  Monitor  circuits  ensure  that  AFS  failure  can  be  detected  prior  to  significant 
performance  degradation.  The  CAFS  will  be  on  cold  standby  for  redundancy  reasons  but  can  also 
be  used  as  a  hot  standby.  Recovery  from  failure  of  other  components  requires  ground  help.  The 
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FIGURE  2  TSA  SYSTEM  BLOCK  DIAGRAM 
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SV  epoch  generator  hardware  divides  the  outputs  of  the  reference  and  system  frequency  sources  to 
obtain  reference  and  system  clocks  (1.5  second  epochs).  The  dividers  are  programmable  and  resetable 
for  initialization  and  adjustment  purposes.  A  phase  meter  measures  the  phase  difference  between 
the  system  epoch  and  the  reference  epoch  and  outputs  a  digital  value  which  represents  coarse  (i  one 
AFS  period)  and  fine  phase  difference  between  them.  The  measured  phase  is  compared  to  the  phase 
predicted  by  software  and  the  difference  is  converted  by  the  DFCMD  generator  to  a  frequency  control 
signal  that  is  applied  to  the  VCXO  which  adjusts  the  VCXO  frequency  to  remove  the  phase  difference. 
The  Z  counter  keeps  track  of  real  time  by  counting  the  reference  epochs.  Software  provides  adjustments 
to  the  epoch  generators  for  initialization  and  clock  correction  and  hardware  monitors  provide  inputs 
to  software  diagnostics  so  that  no  undetected  failures  can  occur. 

The  TSA  software  design  is  illustrated  in  Figure  3.  The  software  predicts  the  phase  difference  between 
the  reference  and  system  clocks  at  each  epoch  using  AFS  performance  models  and  AFS  frequency  data 
stored  in  the  processor.  In  this  implementation  it  must  take  into  account  the  actual  AFS  frequency, 
AFS  frequency  drift,  and  AFS  temperature.  It  reads  the  measured  phase  and  compares  it  to  the 
predicted  phase.  Phase  error  is  converted  to  VCXO  frequency  control  words  (DFCMD)  that  are 
applied  to  the  DAC  in  the  VCXO  which  causes  the  VCXO  to  change  frequency  and  thus  remove  the 
phase  error.  The  DFCMD  value  is  adjusted  in  accordance  with  a  model  stored  in  the  processor  to 
remove  non  linearities  in  the  transfer  function  between  the  DFCMD  and  the  output  frequency  change 
of  the  VCXO.  The  DFCMD  is  also  adjusted  to  produce  VCXO  output  frequencies  in  accordance  with 
an  SA  algorithm  that  is  related  to  the  Z  count.  The  software  also  maintains  a  software  Z  count 
to  ensure  that  the  hardware  Z  count  is  correct.  AFS  performance  models  and  other  performance 


data  are  calculated  prior  to  launch  from  careful  measurements  of  the  performance  of  the  AFS  and 
VCXO.  These  models  and  data  are  uploaded  with  other  SV  software  during  initialization.  The  models 


320 


and  data  are  updated  as  required  during  orbital  operations  based  upon  ground  measurements  of  in- 
orbit  performance.  The  models  and  data  parameters  remain  valid  for  more  than  6  months  although 
corrections  may  be  provided  to  the  user  (in  the  user  message)  as  a  result  of  inter  satellite  measurements 
(cross  link  measurements). 

TSA  SYSTEM  INTEGRITY 


Numerous  hardware  monitors  provide  information  to  the  processor  so  that  there  is  no  possibility  that 
a  single  failure  of  a  TSA  component  can  go  undetected.  Improper  monitor  reading  cause  a  fault  alarm 
to  be  issued.  Figure  4  illustrates  the  hardware  monitoring  arrangement.  The  following  hardware 
monitors  are  provided: 


•  AFS  activity  detector.  Detects  AFS  output. 

•  VCXO  activity  detector.  Detects  VCXO  output. 

•  AFS  lock  status.  Detects  if  AFS  loop  is  locked. 

•  Reference  and  system  epochs. 

•  Second  harmonic  level.  Detects  level  of  AFS  modulating  signal. 

•  Z  counter.  Value  of  Z  count 

•  Phase  meter  (S/W  looks  for  phase  jumps  and  erroneous  precession). 

•  Nuclear  event  detector. 

•  AFS  temperature.  Measures  AFS  baseplate  temperature 

•  Cross  link  measurements 


FIGURE  4  TSA  INTEGRITY  MONITORING 
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The  first  four  of  the  above  monitors  are  go,  no-go  detectors  which  indicate  failures  of  the  AFS,  VCXO, 
and  system  and  reference  clocks  directly.  In  the  case  of  the  system  and  reference  epochs,  software 
also  maintains  a  watchdog  timer.  If  the  epochs  do  not  occur  within  a  specified  period  of  time,  an 
alarm  is  issued  regardless  of  the  status  of  the  hardware  monitors.  The  second  harmonic  detector  will 
also  indicate  AFS  failure;  in  addition,  it  will  often  provide  an  early  warning  of  AFS  failure  conditions. 
If  the  level  changes  20%  with  respect  to  a  running  average  (calculated  by  software),  experience  has 
shown  that  it  is  probable  that  something  is  going  wrong  with  the  AFS  even  if  its  output  remains 
unaffected.  The  value  of  previous  Z  counts  is  stored  by  software.  At  each  epoch  one  is  added  to  the 
previous  Z  count  and  the  result  is  compared  to  the  current  Z  count.  Mismatches  not  accompanied  by 
other  alarms  indicate  that  a  logic  upset  has  occurred. 

The  phase  measurements  are  the  most  indicative  of  the  health  of  the  TSA.  Phase  values  can  indicate 
catastrophic  failure,  logic  upsets,  and  health  that  is  slowly  deteriorating.  A  single,  fixed  phase  jump 
that  continues  for  more  than  on  or  two  epochs  is  an  indication  that  a  logic  upset  has  occurred.  Erratic 
and  continuous  phase  errors  indicate  a  component  failure.  Phase  values  that  indicate  a  precession 
that  is  different  from  the  expected  precession  are  indicative  of  AFS  frequency  changes.  This  can  be 
detected  before  system  performance  is  affected.  Phase  changes  are  likely  to  be  the  first  indication  that 
there  is  a  problem  and  thus  ensure  that  action  can  be  taken  within  one  or  two  epochs. 

The  nuclear  event  detector  and  AFS  temperature  monitor  are  not  strictly  TSA  integrity  monitors. 
The  nuclear  event  detector  confirms  the  cause  of  upset  and  therefore  is  useful  in  determining  recovery 
actions.  The  temperature  monitor  is  used  by  the  phase  predictor  when  it  is  calculating  expected  phase 
since  the  frequency  of  the  AFS  varies  slightly  with  temperature.  However,  out  of  range,  non  cyclic, 
or  erratic  temperature  changes  indicate  something  is  wrong  with  the  AFS.  Cross  link  measurements 
between  insight  Block  2R  satellites  also  provides  an  important  integrity  check.  They  are  made  hourly 
and  will  indicate  slow  or  fast  time  changes  that  have  not  been  predicted. 

System  integrity  is  software  intensive.  No  hardware  recovery  or  alarm  action  takes  place  directly. 
Software  takes  appropriate  action  on  the  basis  of  monitor  inputs.  The  software  also  maintains  the 
usual  internal  range  checks  and  time  outs  to  ensure  that  the  software  is  operating  correctly.  Any 
fault  alarm  will  cause  the  software  to  enter  a  diagnostic  routine  which  determines  what  has  failed 
and  whether  it  is  possible  to  recover  autonomously  without  affecting  performance.  If  it  is  possible  to 
recover  autonomously  the  TSA  does  so.  If  not  an  alarm  is  placed  in  the  user  message.  A  complete 
description  of  autonomous  recovery  is  not  covered  in  this  paper,  but,  in  general,  if  the  failure  is  limited 
to  the  AFS,  or  if  the  upset  is  limited  to  either  the  system  or  reference  timing  autonomous  recovery  is 
possible. 


PREDICTED  TSA  PERFORMANCE  PARAMETERS 


Engineering  models  and  prototypes  of  the  frequency  standards  and  other  TSA  functions  have  been 
built  and  initial  tests  completed.  Analysis  of  the  test  results  leads  me  to  believe  that  the  following 
performance  can  be  achieved. 


•  Short  Term  Frequency  Stability:  VCXO  1  x  10"12;  CAFS  3  X  10“n;  RAFS  3  x  1(T12 

•  Long  Term  Frequency  Stability:  CAFS  5  X  10-14;  RAFS  1  X  1  — _14 

•  TSA  User  Range  Error  (24  hour,l  Sigma):  CAFS  2.6  m;  RAFS  1.8  m 
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•  Frequency  Drift  (RAFS):  Removed  by  modeling 

•  Temperature  Sensitivity:  RAFS  1  X  10~13  change  in  freq  per  degree  C 

(Decreased  to  2.4  x  10-14  by  modeling) 
CAFS  Negligible 

•  AFS  Reliability:  Better  than  0.75 

•  Power  Consumption:  CAFS  20  watts;  RAFS  14  Watts 

•  Weight:  CAFS  26  LBS;  RAFS  12  LBS 

IMPROVEMENTS  TO  THE  TSA  DESIGN 


The  TSA  is  no  exception  to  the  rule  that  all  designs  can  be  improved.  Possible  future  improvements 
to  the  TSA  that  can  be  made  as  a  result  of  experience  gained  on  this  design  range  from  minor 
enhancements  to  complete  redesigns.  The  software  intensive  nature  of  the  design  presents  possibilities 
for  increased  use  of  autonomous  recovery  and  improved  availability  due  to  autonomous  redundancy 
management.  Minor  changes  (in  the  technical  sense)  to  the  hardware  and  software  would  permit 
autonomous  recovery  from  many  TSA  hardware  failures  and  all  TSA  hardware  upsets.  These  changes 
are: 

•  Add  a  hot  standby  VCXO  so  that  VCXO  and  AFS  switchover  is  possible. 

•  Duplicate  or  time  share  the  phase  measurement  circuitry. 

•  Provide  software  controlled  management  of  hot  standby  VCXO. 

•  Add  software  diagnostic  routines  to  locate  upsets  and  failures. 

•  Add  software  performance  analysis  routines  to  characterize  operation. 

•  Reduce  the  number  of  AFS  from  three  to  two. 

The  first  three  of  the  above  changes  increases  availability  by  incorporating  autonomous  hardware 
redundancy  management  of  the  AFS  and  VCXO  hardware.  Duplicating  or  time  sharing  the  phase 
measurement  circuitry  permits  monitoring  and  assessing  the  performance  of  the  AFS  and  VCXO  hot 
standbys.  The  fourth  change  would  increase  availability  by  permitting  autonomous  recovery  from 
TSA  logic  upsets.  It  provides  for  the  effective  use  of  the  first  three  changes.  The  fifth  change  provides 
the  means  to  model  the  performance  of  the  TSA  during  operation  thus  improving  the  ability  of  the 
phase  predictor  to  predict  phase.  The  last  change  recognizes  17  years  of  improvements  made  in  the 
reliability  of  atomic  frequency  standards  and  the  improved  availability  as  a  result  of  autonomous  AFS 
switching. 

Another  improvement  would  be  to  develop  a  nuclear  upset  proof  digital  frequency  synthesizer.  The 
original  TSA  system  design  incorporated  a  digital  frequency  synthesizer  to  generate  the  10.23  MHz 
and  to  provide  SA.  This  approach  was  abandoned  and  a  VCXO  used  in  its  place  because  an  nuclear 
upset  proof  synthesizer  was  not  available.  It  seems  likely  that  technology  has  advanced  to  the  point 
where  such  a  synthesizer  is  now  possible.  Synthesizers  permit  a  single  AFS  to  drive  both  the  reference 
and  system  clocks,  further  improving  availability,  and  SA  functions  are  simplified. 
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In  the  present  design,  many  TSA  functions  are  included  as  part  of  other  functions.  Hard  ware  functions 
are  located  in  the  Mission  Data  Unit  (MDU)  and  the  TSA  software  is  located  in  the  mission  processor. 
Also,  the  system  epoch  generator  is  part  of  the  P  code  generator.  The  current  hardware  configuration 
evolved  from  previous  GPS  designs  but  is  not  the  best  way  to  ensure  TSA  performance  and  pro- 
ducibility  and  results  in  complex  MDU  hardware  and  mission  processor  software.  The  TSA  should 
be  configured  into  three  functions;  AFS,  VCXO,  and  TSA  logic.  The  TSA  logic  should  include  its 
own  processor.  Such  a  configuration  would  simplify  the  MDU  and  mission  processor  software,  reduce 
VCXO  redundancy  by  2,  permit  separate  testing  of  the  MDU  and  TSA,  and  improve  the  producibility 
of  both  the  TSA  and  the  MDU. 
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